Commit graph

38362 commits

Author SHA1 Message Date
Jay Satiro
1068d048ec tool_doswin: increase allowable length of path sanitizer
- Use 32767-1 instead of PATH_MAX-1 (260-1) as the maximum allowable
  length of a path in Windows.

Prior to this change the path sanitizer in Windows used 32767-1 as the
maximum length only for paths that had the "\\" prefix like
"\\?\longpath". Since then we added some workarounds to open longer
paths without "\\?\" prefix by normalizing the path and adding that
prefix, and the sanitizer is called before the prefix is added.

Bug: https://github.com/curl/curl/issues/20044
Reported-by: Viktor Szakats

Closes https://github.com/curl/curl/pull/20046
2025-12-30 04:00:50 -05:00
Stefan Eissing
52ac8104e1
ratelimit blocking: fix busy loop
Fix the pollset in perform state to not add sockets for directions
that are blocked. This otherwise will lead to busy loops for a
transfer that cannot be progressed.

Reported-by: Fizn-Ahmd on github
Fixes #20091
Closes #20109
2025-12-29 22:44:34 +01:00
Harry Sintonen
16d5f2a566
libssh: require private key or user-agent for public key auth
Closes #20110
2025-12-29 17:28:22 +01:00
Daniel Stenberg
bc9ab557df
telnet: abort on bad suboption sequence
Instead of trying to repair.

Reported-by: Huseyin Tintas

Closes #20108
2025-12-29 10:49:30 +01:00
Daniel Stenberg
7fc78c2c1c
urlapi: set uncondtional return code
Curl_parse_login_details() can only return a single return code so
adjust accordingly.

Pointed out by CodeSonar

Closes #20107
2025-12-29 10:17:49 +01:00
Daniel Stenberg
2754e0f3d3
url: return error at once when OOM in netrc handling
Closes #20103
2025-12-29 10:16:48 +01:00
Daniel Stenberg
5c0cdd26d6
strcopy: minor comment edit to avoid matching a grep for strcpy use 2025-12-27 23:25:13 +01:00
Daniel Stenberg
6842d4ec4d
curl_quiche: refuse headers with CR, LF or null bytes
Also renamed the struct field to 'h1hdr' from 'scratch' to better say
what its purpose is.

Closes #20101
2025-12-27 16:27:11 +01:00
Daniel Stenberg
0e054134b7
urlapi: return OOM correctly from parse_hostname_login()
Closes #20100
2025-12-27 16:25:55 +01:00
Daniel Stenberg
0ccd16d29a
ftp: return from ftp_state_use_port immediately on OOM
Closes #20100
2025-12-27 16:25:52 +01:00
Daniel Stenberg
19ca87d4e2
cf-socket: return OOM error if socket() failes due to OOM
Closes #20100
2025-12-27 16:25:38 +01:00
Viktor Szakats
7032982896
tidy-up: miscellaneous
- asyn-thrdd.c: scope an include.
- apply more clang-format suggestions.
- tidy-up PP guard comments.
- delete empty line from the top of headers.
- add empty line after `curl_setup.h` include where missing.
- fix indent.
- CODE_STYLE.md: add `strcpy`.
  Follow-up to 8636ad55df #20088
- lib1901.c: drop unnecessary line.
  Follow-up to 436e67f65b #20076

Closes #20070
2025-12-26 22:06:09 +01:00
Daniel Stenberg
abcb10f3ac
ftp: return better on OOM in two places
Found with strict torture testing.

Closes #20099
2025-12-26 10:48:41 +01:00
Daniel Stenberg
a585cc35e5
memdebug: stop tracking send and recv
- they rarely catch any problems
- we have other ways to test different send/recv problems
- the number of such calls vary much more per invoke than others, making
  memdebugging harder
- reducing the total number of fallible functions per test is good
- they were not used as intended anyway

Closes #20097
2025-12-26 10:27:27 +01:00
Daniel Stenberg
d4b62bff64
curl_threads: don't do another malloc if the first fails
Closes #20095
2025-12-25 22:14:39 +01:00
Viktor Szakats
685173e881
src: drop unused includes
Also replace some indirect includes with direct ones.

Closes #20096
2025-12-25 18:42:54 +01:00
Daniel Stenberg
ed966832b6
RELEASE-NOTES: synced 2025-12-25 12:13:55 +01:00
Daniel Stenberg
18af4e4e10
cookie: flush better
The cookie flushing (saving to a cookie jar) should only be done if a
transfer has been started. This is now done by checking the
cookies->running field, which is not reset in curl_easy_reset() so the
saving works correctly even after a call to that.

Follow-up to fd6eb8d6e7

Verified by test 1920

Reported-by: Alexander Batischev
Fixes #20090
Closes #20094
2025-12-25 12:05:23 +01:00
Viktor Szakats
e78a466ebd
lib: drop unused protocol headers
- drop unused `http.h` includes.
- drop unused `http1.h` include.
- drop unused `http2.h` includes.
- vssh/ssh.h: drop unused `vssh.h` include.
- urldata.h: drop unused protocol includes.
- url: include `smtp.h` directly.
- rtsp.h: include directly where used.
- imap, smtp: drop redundant include, move another from .h to .c.

Verified with an all non-unity CI run.

Closes #20093
2025-12-25 12:00:22 +01:00
Daniel Stenberg
adca486c12
libssh: set both knownhosts options to the same file
Reported-by: Harry Sintonen

Closes #20092
2025-12-25 11:01:41 +01:00
Viktor Szakats
c882439d53
os400sys: replace strcpy() with memcpy()
Source and target are the same size, null-terminator is already present
in the target buffer.

Closes #20089
2025-12-24 23:53:40 +01:00
Daniel Stenberg
ca46112991
curl_ntlm_core: fix DES_* symbols for some wolfSSL builds
Recent wolfSSL with OPENSSL_COEXIST enabled does not provide the DES_*
symbols, so we do.

Reported-by: Daniel Pouzzner
Closes #20083
2025-12-24 22:49:43 +01:00
Daniel Stenberg
76e7d496b6
escape: add a length check in curl_easy_escape
Only accept up to SIZE_MAX/16 input bytes. To avoid overflows, mistakes
and abuse.

Follow-up to 9bfc7f9234

Reported-by: Daniel Santos

Closes #20086
2025-12-24 22:47:26 +01:00
Viktor Szakats
8636ad55df
checksrc: ban strcpy
No longer used in the codebase. Replacement is `curlx_strcopy()`, possibly
`memcpy()` or dynbuf.

Also:
- OS400: allow three calls.

Closes #20088
2025-12-24 13:55:25 +01:00
Viktor Szakats
532d134767
build: stop disabling strcpy checks with clang-tidy
Follow-up to 436e67f65b #20076

Closes #20084
2025-12-24 00:02:40 +01:00
Viktor Szakats
436e67f65b
tests: replace strcpy() with curlx_strcopy()
Also:
- examples/hsts-preload: apply the same change as it's based on lib1915
  in tests. Make a local clone of `curlx_strcopy()`. Then drop the
  `_CRT_SECURE_NO_WARNINGS` hack, that's no longer necessary.
- curl_setup.h: delete `strcpy()` from the `_CRT_SECURE_NO_WARNINGS`
  list.

Closes #20076
2025-12-23 22:25:39 +01:00
Viktor Szakats
66aec526fc
lib547, 555: fix off-by-one null-terminator in read callback
`strcpy()` wrote an unnecessary null-terminator past the available read
buffer.

test551 was also affected because it reuses lib547.

Cherry-picked from #20076
Closes #20082
2025-12-23 19:49:59 +01:00
Daniel Stenberg
7e064d0756
cf-h1-proxy: support folded headers in CONNECT responses
Update test 1941 to verify this

Remove unused code from dynhds for handling folded headers, and the
associated unit tests of those functions in test 2602 and 2603.

Closes #20080
2025-12-23 17:12:14 +01:00
renovate[bot]
cb9db70dbe
GHA: update ngtcp2/nghttp3 to v1.14.0
Closes #20078
2025-12-23 17:09:05 +01:00
renovate[bot]
1b4ef87dee
GHA: update ngtcp2/ngtcp2 to v1.19.0
Closes #20079
2025-12-23 17:01:38 +01:00
Viktor Szakats
17628b15ec
vquic: initialize new callback in nghttp3 1.14.0+
Fixing (seen in curl-for-win production build):
```
lib/vquic/curl_ngtcp2.c:1257:1: error: missing field 'recv_settings2' initializer [-Werror,-Wmissing-field-initializers]
 1257 | };
      | ^
1 error generated.
```
Ref: https://ci.appveyor.com/project/curlorg/curl-for-win/builds/53281785#L6752
Ref: https://github.com/curl/curl/actions/runs/20459295003/job/58788229134#step:3:5513

Also:
- Mark previous callback deprecated.
- Document ngtcp2, nghttp3 versions for callback entry feature guards.

Refs:
https://github.com/ngtcp2/nghttp3/releases/tag/v1.14.0
https://github.com/ngtcp2/nghttp3/pull/432
1616ab8350

Closes #20077
2025-12-23 13:34:07 +01:00
Daniel Stenberg
a535be4ea0
curlx: curlx_strcopy() instead of strcpy()
This function REQUIRES the size of the target buffer as well as the
length of the source string. Meant to make it harder to do a bad
strcpy().

Removes 23 calls to strcpy().

Closes #20067
2025-12-22 23:01:05 +01:00
Stefan Eissing
f099c2ca55
apple sectrust: fix ancient evaluation
On versions before macOS 10.14, ios 12 and watchos 5, check the
evaluation code to return the error from evaluation.

Reported-by: Stanislav Fort
Closes #20074
2025-12-22 23:00:08 +01:00
Daniel Stenberg
230ee539e6
CURLOPT_HAPROXY_CLIENT_IP.md: emphasize reused connection use
Closes #20075
2025-12-22 22:53:14 +01:00
Daniel Stenberg
6b9c75e219
content_encoding: avoid strcpy
Build list with dynbuf.

Closes #20072
2025-12-22 14:17:21 +01:00
Viktor Szakats
d92e264ff0
curlx: rename Curl_-prefixed symbols to curlx_
Closes #20069
2025-12-22 01:47:22 +01:00
Viktor Szakats
6e6fafa9b0
binmode: delete extra nop instruction from fallback macro
Follow-up to 250d613763 #15787

Closes #20068
2025-12-22 01:47:21 +01:00
Viktor Szakats
4ad87f2cb8
checksrc: ensure using ifdef/ifndef when possible, fix fallouts
Follow-up to 89771d19d5 #18018

Closes #20065
2025-12-21 21:12:31 +01:00
Viktor Szakats
e8415a8296
lib: drop, or replace sendf.h with curl_trc.h where possible
- replace `sendf.h` with `curl_trc.h` where it was included just for it.
- drop unused `curl_trc.h` includes.
- easy: delete obsolete comment about `send.h` include reason.

Also:
- move out `curl_trc.h` include from `sendf.h` and include it directly
  in users, where not done already. To flatten the include tree and
  to less rely on indirect includes.
- stop including `sendf.h` from other headers, replace it with forward
  declaration of `Curl_easy`, as done already elsewhere.

Verified with an all non-unity CI run.

Closes #20061
2025-12-21 12:39:25 +01:00
Viktor Szakats
4df7269ba8
test96: fix to accept non-unity memdump content with MSVC
In unity builds the source filename (via `__FILE__`) has no path (or
uses slashes?), while in non-unity ones it does contain backslashes
on Windows, with MSVC. Fix the test to recognize backslashes in the
`stripfile` regexp.

Seen in MSVC jobs in CI:
```diff
-MEM tool_cfgable.c[LF]
-MEM tool_paramhlp.c[LF]
-MEM tool_cfgable.c[LF]
-MEM tool_cfgable.c[LF]
-MEM tool_cfgable.c[LF]
-MEM tool_cfgable.c[LF]
+MEM D:\a\curl\curl\src\tool_cfgable.c[LF]
+MEM D:\a\curl\curl\src\tool_paramhlp.c[LF]
+MEM D:\a\curl\curl\src\tool_cfgable.c[LF]
+MEM D:\a\curl\curl\src\tool_cfgable.c[LF]
+MEM D:\a\curl\curl\src\tool_cfgable.c[LF]
+MEM D:\a\curl\curl\src\tool_cfgable.c[LF]
```
Ref: https://github.com/curl/curl/actions/runs/20408366058/job/58641468316?pr=20061#step:13:303
Ref: https://github.com/curl/curl/actions/runs/20408522070/job/58641826216?pr=20064#step:13:298

Closes #20064
2025-12-21 12:11:56 +01:00
Viktor Szakats
4cf88d8477
x509asn1: drop unused hostcheck.h, vtls_int.h includes
Closes #20063
2025-12-21 11:14:22 +01:00
Viktor Szakats
884b5ea921
lib: include curlx/warnless.h from curl_setup.h
To make it available for all files. Drop includes from individual
sources. This header was already included from most sources and not
specific to any internal subsystem.

Also to ensure that two system symbol redefines on Windows (`read()` and
`write()`) get applied to all sources. Move them to `curl_setup.h`.

Closes #20056
2025-12-21 02:36:33 +01:00
Viktor Szakats
70651cb6de
lib: drop unused vssh/ssh.h includes
Closes #20060
2025-12-21 02:31:58 +01:00
Viktor Szakats
a3f866ac76
transfer: drop unused vquic/vquic.h include
Closes #20059
2025-12-21 02:31:58 +01:00
Viktor Szakats
6011b83852
curl_ntlm_core: move vauth/vauth.h include from header to source
To not include it implicitly for all `curl_ntlm_core.h` users.

Closes #20058
2025-12-21 02:16:34 +01:00
Viktor Szakats
d4298603b5
tidy-up: curlx/nonblock.h includes
Delete where unused, include where to used to avoid relying on
side-effect of other headers.

Also: delete "for curlx_nonblock" comments. That's the only symbol
offered by this header.

Closes #20055
2025-12-21 02:16:34 +01:00
Viktor Szakats
fdb5152091
lib: drop unused vtls/vtls.h includes
Closes #20057
2025-12-21 02:16:34 +01:00
Viktor Szakats
3c1c299b27
lib: drop unused curlx headers
`curlx/base64.h` and `curlx/strparse.h`.

Closes #20054
2025-12-21 02:16:33 +01:00
Viktor Szakats
a354cc8664
lib: drop includes unused or duplicate
Closes #20051
2025-12-20 22:02:20 +01:00
Viktor Szakats
df4edd28f2
socks.h: delete obsolete, unused, macros
Unused since dafdb20a26 #9855

Cherry-picked from #20051

Closes #20053
2025-12-20 21:14:56 +01:00